GitHub Scan Using GHE Endpoint and Specifying --org Flag Scans Authenticated Users Repositories & Gists

[marshalltech81]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

TruffleHog Version

trufflehog 3.16.2

Trace Output

Cannot provide trace output because for security would expose the environment I am running in

Expected Behavior

When performing a trufflehog github --endpoint="GHE_ENDPOINT" --org="ORG" --token="TOKEN" --only-verified, I have the expectation that trufflehog is only scanning the repos in the organization specified on the command line.

Actual Behavior

When performing a trufflehog github --endpoint="GHE_ENDPOINT" --org="ORG" --token="TOKEN" --only-verified, trufflehog appears to scan my personal repositories on GHE and it also appears to scan my gists. In scanning my gists trufflehog is getting a 404 error back from GHE indicating that the repo cannot be found despite the fact the gist does exist despite the fact I do not think there is an expectation that it be scanned.

ERRO[0072] Could not get Github repository: https://xxx.github.com/gist/30277a89cb10b56662540cffa6929f98.git  error="GET https://xxx.github.com/api/v3/repos/gist/30277a89cb10b56662540cffa6929f98: 404 Not Found []"
ERRO[0074] Could not get Github repository: https://xxx.github.com/gist/34b4a93acdcabcc428c7be02890ae24b.git  error="GET https://xxx.github.com/api/v3/repos/gist/34b4a93acdcabcc428c7be02890ae24b: 404 Not Found []"

Steps to Reproduce

trufflehog github --endpoint="GHE_ENDPOINT" --org="ORG" --token="TOKEN" --only-verified

Environment

• OS: macOS
• Version Montery

Additional Context

References

• #0000

[ahrav]

@marshalltech81 thanks for pointing this out, really appreciate it. 😄